sgerlach/vuln-grpc-kotlin

A vulnerable gRPC kotlin application

A gRPC API vulnerable app

For testing hawkscan GRPC and protobuf capabilities.

Development

This is a gradle base project, use ./gradlew tasks command to see all available options.

Lint check code

./gradlew ktlintCheck

Format code

./gradlew ktlintFormat

Build jar

./gradlew bootJar 

Run the jar you just built 👆

java -jar build/libs/vuln-grpc-kotlin.jar

Spring run

./gradlew bootRun

Building and Running in Docker

Build

docker-compose build

Run docker

docker-compose up -d

Using the Application

Reaching the App

Once the app starts up, you can reach it at https://localhost:9001.

A good tool for gRPC testing locally is https://kreya.app/

PS: You'll need Postgres for local development.

Testing

See GrpcProxyClientTest.kt for an example of proxying gRPC traffic through hawkscan/ZAP.